Bedside
datawrangler inside a container. An internal ESM service
leaked the developer SSH key via path traversal, and that account's
sudo-run PyTorch trainer loaded an attacker-controlled checkpoint — a second unsafe
deserialization — for root.
01Why the full writeup is held back
Bedside is a live Season 11 machine, so — in line with Hack The Box's guidance on active machines — I'm not publishing a step-by-step reproduction. The complete writeup (vhost discovery, the pdfminer pickle RCE, the container pivot / ESM traversal, and the PyTorch-checkpoint privesc, with commands and remediation) goes live here once the season closes.
02The interesting bits (no spoilers)
Deserialization, twice — pickle then PyTorch
Both the foothold and root came from the same root cause in two forms: unsafe deserialization.
First a malicious pickle delivered through a PDF that pdfminer.six processed;
then a malicious PyTorch checkpoint loaded by a trusted training script. "Loading" untrusted
data is executing it.
Container isolation that wasn't
The initial shell landed inside a container, but an internal development service was reachable from it and path-traversal on that service leaked host files — including an SSH private key. A reminder that a container boundary is only as strong as what it can still talk to.
03Takeaways
- Never deserialize untrusted input —
pickleandtorch.loadboth execute code; use safe formats /weights_only. - Fuzz for virtual hosts — the whole chain started with an unadvertised
research.vhost. - Containers aren't a security boundary by themselves — audit what internal services a compromised container can reach.
- Sudo rules that load data are dangerous — a "safe" script becomes RCE when it consumes attacker-controlled files.